It might be best to attach your configuration (be sure to remove any sensitive data from the CFG text file such as passwords or pre-shared keys). But one of the things I encounter is the policy-class (security zone) for the guest network. Assuming you created a new policy-class for guests, an allow policy must be in place for guest clients to request a DHCP address.
You wouldn't want to allow guests access to http or telnet for management though, only DHCP. Possibly DNS too, if you're telling DHCP clients to use the 3430 as their DNS server. This might do the trick:
!
ip access-list standard wizard-ics
remark Internet Connection Sharing
permit any
!
!
ip access-list extended RouterAdminAccess
remark Types of connections used for management
permit tcp any host 192.168.100.1 eq telnet
permit tcp any host 192.168.100.1 eq ssh
permit tcp any host 192.168.100.1 eq www
permit tcp any host 192.168.100.1 eq https
!
ip access-list extended self
remark Traffic to NetVanta
permit ip any any
!
!
ip policy-class GUEST
discard list RouterAdminAccess
allow list self self
nat source list wizard-ics interface eth 0/2 overload policy Public
!
ip policy-class Public
! implicit discard
!
In this example, the router's guest interface is 192.168.100.1 (also assigned in DHCP) and it's assigned to the GUEST security zone. The Internet interface is in Public. The order of policies listed under each policy-class is crucial. Here, we discard any connections from guests to the router used for administration, but then allow other, non-management connections. DHCP requests would be part of that next "self" policy. Last, we NAT out general Internet traffic like normal.
There could be other factors, so consider attaching your config (sanitized) if this doesn't help.
Chris
